SBOM

The self-propagating worm is back. This time it poisoned keyv, an npm caching library that ships in millions of builds, and it plants a second trigger that fires the next time a developer just opens the project.